GitHub is set up to require two-factor authentication (2FA) for all developers contributing code to any project on the platform. This is a move designed to strengthen the software supply chain.
The Microsoft-owned code-hosting platform announced in May last year that it intended to make 2FA mandatory by the end of 2023, but it began the process for its top 100 packages earlier that year, and announced in November was followed by other “high impact” packages. These were defined as packages with more than 1 million downloads each week or packages with more than 500 dependencies (projects using the package in question).
GitHub has now confirmed that platform-wide enforcement will begin on March 13, 2023 (four days from now). This process will be phased out to different groups of developers and project managers throughout the rest of the year.
supply chain
With nearly 100 million developer users, GitHub is an important part of the global software supply chain. And while concerns about software supply chain security have been on the rise for some time, recent high-profile attacks have pushed the issue to the top of the global political agenda. This included a breach at US software company SolarWinds in 2020 that impacted numerous government agencies and companies using the software. It also includes the critical Log4Shell security flaw that appeared in a popular open source logging tool called Log4j.
A notable security incident like this prompted action when the Biden administration issued an executive order to ensure the nation’s cyber defenses in 2021. And last week, the government announced a new cybersecurity strategy. This includes asking Big Tech to take more responsibility for ensuring the robustness of their systems, and mandatory his 2FA can help in some way.
Open source software, in particular, has been a major focus of the administration’s cybersecurity efforts over the past few years, largely due to its prevalence. In fact, most software contains at least some open source components, many of which are in the hands of one or two of his developers, who in their spare time It is working and has little financial support.
It is against this background that GitHub has pushed its 2FA agenda over the past year. This is to reduce the chances of major open source projects being compromised by bad actors through social engineering and similar account takeover attempts.
Phased rollout
GitHub’s phased approach to enforcing 2FA is a calculated attempt to ensure that everyone who needs onboarding can do so at their own will and time.
“This phased rollout will allow developers to successfully onboard and adjust as needed before scaling to a larger group as the year progresses,” GitHub wrote in a blog post. increase. “GitHub is the heart of the software supply chain, and securing the software supply chain starts with the developers.”
Developers targeted during this initial 2FA registration push will receive an email and will also see a banner on their GitHub dashboard asking them to sign up. He will then be given 45 days to activate 2FA, during which he will be prompted regularly. If within 45 days he does not have 2FA configured, he will be prompted to enable 2FA the next time he tries to access his GitHub account, but he will also be allowed to “snooze” for a week. You can also After that, if you want access to any aspect of your GitHub account, including the ability to publish your code, you have no choice but to set up 2FA.
GitHub users can choose their 2FA mechanism from SMS, physical security keys, third-party authenticator apps, and the GitHub mobile app, but GitHub advises enabling multiple 2FA methods as a fail-safe measure. increase.
GitHub 2FA in action image credit: GitHub
Note that 2FA Push does not end with the first registration. Users who have set up 2FA will receive another prompt after 28 days asking them to validate their 2FA method. This is designed to prevent developers from getting locked out of their accounts due to misconfiguring their authenticator app or mistyping their mobile number. At this stage, if the user is unable to authenticate her account, she will be prompted to reset her 2FA method without losing access to her account.
As for which developers will start receiving 2FA prompts starting March 13, GitHub has previously collected various data points, including how often they publish, whether they’re admins of the company, and whether they contribute more. He said he would take it into consideration. Popular public and private repositories.
Following this initial rollout, GitHub said it will apply lessons learned to broader rollouts through 2023.
